Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c4586a327b922e0…

MALICIOUS

PDF

111.0 KB Created: 2021-03-27 13:55:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: abd48ac32bb30a819b46e0ea0a5613a3 SHA-1: 21d1b6198b9b3e252efa9914fa0bdf714bb66810 SHA-256: 8c4586a327b922e0fc82af92703854b8ad22e2dee6eb2831467cc342f22631eb
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to a musical PDF, further supporting a phishing pretext.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zajinet.ru/award?keyword=bach+well+tempered+clavier+pdf
    • http://kixalilabuzawov.medianewsonline.com/93352141226.pdf
    • https://cdn.sqhk.co/xekejegixawo/9ho0ro8/the_banner_saga_2_characters.pdf
    • https://cdn.sqhk.co/jeviseme/dvvQiiu/funny_prank_call_ideas_for_mcdonald_s.pdf
    • http://yachtcharter.group/i_wanna_iguana_persuasive_lesson_planrja98.pdf
    • https://cdn.sqhk.co/wopidevepip/cbMjfja/huey_magoos_sunrise_reviews.pdf
    • https://cdn.sqhk.co/burexewejam/pjihc8g/67355376737.pdf
    • http://drive4mclaneeffingham.com/what_is_the_best_bait_to_use_for_saltwater_fishingxag8d.pdf
    • http://ipai.online/vowipasujafipiletejejamup4opmw.pdf
    • http://betmoy57.com/puburobojalapivnaonl.pdf
    • http://7evenrp.ru/how_to_setup_holmes_cool_mist_humidifier_for_babyq0719.pdf
    • http://discovljzg.fun/borufixu8utaw.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/lunojol/monitor_cardiaco_polar_a300.pdf
    • https://2e6726a7-2e78-456a-9fa1-8bc85c3b20a6.filesusr.com/ugd/76e31d_fd0ada46194f4b4ea6d228dfcf37fe8c.pdf?index=true
    • http://lexekuduwowig.atwebpages.com/mesexuxoniji.pdf
    • https://s3.amazonaws.com/zakunafu/fbla_competitive_events_study_guide.pdf
    • https://d80868e2-5d34-4dda-9345-0396294a35aa.filesusr.com/ugd/f9fac6_464d78c70af7417c860567544fd67e1d.pdf?index=true
    • https://76ed6b59-b034-43ac-b949-e1c08f76e3cb.filesusr.com/ugd/ee6100_df1dd50a84ec4737a81d61e330c129e1.pdf?index=true
    • https://s3.amazonaws.com/sizabo/how_to_use_sentry_1330_safe.pdf
    • https://s3.amazonaws.com/xuvamuba/ludisamotodorolitaxadase.pdf
    • https://s3.amazonaws.com/zesotat/ffxiii-_2_chocobo_racing_guide.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00015af5.bin
3473f958b27a57a321a73eed0437ed274cba28a14f8f11f1896131cfdda2278a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15AF5 5416 bytes
font_01_sfnt_off00016d52.bin
25e78bae0e9fe923fba8321da2e4641a547ef1d1791bcdd8793661e1b5065fdc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16D52 13120 bytes
font_02_sfnt_off00019919.bin
fb7b45e24c28c4473d0ca1c6410c593992d9a809009f9c41b5ae32c9142507dd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x19919 16120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.